Analysis

  • max time kernel
    178s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    22-05-2024 16:58

General

  • Target

    67f465f3390b181f1dd8d2b5c1eeb521_JaffaCakes118.apk

  • Size

    3.8MB

  • MD5

    67f465f3390b181f1dd8d2b5c1eeb521

  • SHA1

    38eee93cb11a620f990819f9df5422e85c641061

  • SHA256

    e6b9441bf831daa31a34ad7afd9a6f6777381c2b367892000d9f42c5d01e3292

  • SHA512

    6497265bf748bd67b1369cf3822b803a9f99243792ec6930473aa49a1c371ef22bfe35d8c3efd252d602646240a1341836cc8a7ae86d4b7c475a94695c55c744

  • SSDEEP

    98304:bGq6flX47Rh+qC4pWQlI4C380WfHkA4CulJGO+YeUAroPH9rs1:bGq6flI7Rh+qtpVlI4Tv/kHhWoPHk

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.mayizaixian.myzx
    1⤵
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5152
  • com.mayizaixian.myzx:ixintui_service_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5366

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db
    Filesize

    28KB

    MD5

    9bf5f66a1470610bde57127432f2701a

    SHA1

    51fadba5c7896d5ff4edd33a8cc4f29da3e5060e

    SHA256

    03be0bcc9323a0328d6e47197bce803076d36f53e5cde4ebe700cc81e580aad8

    SHA512

    0bed5033feb5809e68606c16d85ae23bc44324ab88a26cc694930b067cbd95058f296a6a57bb98375db2c09263102e6e9dc8b4fe12360867dd05e2e61b053161

  • /data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journal
    Filesize

    512B

    MD5

    51cbd0b414d9ccab7bf949e599de3791

    SHA1

    33f5ebee525b0745651b69d2ac72b54923c8068a

    SHA256

    dd3eaa010ca4e23fed7304addaa6432da75cc19180ad7e1d670349de78165ef8

    SHA512

    db176c58f1d1442300453b9ed257c0211f7d4be7921e8a0fb0e9cef23fd5fee14baa44f3c35a46e2eea51b54088a03645e887d2b8965a2a5733b8eb5ab2781b4

  • /data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journal
    Filesize

    8KB

    MD5

    66d4a32818f5858a3a3461b9293ac40b

    SHA1

    f76d2993e0527075a42f7fbc84e95695f27ad244

    SHA256

    ef2178340e36dcb65e8f81d4edf38d2488edc999bb2cc91d088c7c79e6cc8c08

    SHA512

    987fb29f6152ef03007f01f657ec5ba685d80447b2e0f3f6c79fd01a73ba223addb3fc151df9642f447cc1e88c7be9af4138e89e5025b9160cd41c932f6671e5

  • /data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journal
    Filesize

    8KB

    MD5

    39bff93a87f375270c83cb5064cffda9

    SHA1

    588da912cb5cf59f304b8d7f7e3b7dd29c4c283b

    SHA256

    4f47bd41c0a183ae15ce3877cafb5f89ef0e7f2fe563ddf295b9246ff879ca3f

    SHA512

    52a3d005d4f3228ccb767ea9e0ddb6656603d3a8dd366815bb8624a80e2735fc8644238eacbd3e84a303c641602a1fc83e00e11e3018a32b4c5b87b6ec327abd

  • /data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journal
    Filesize

    12KB

    MD5

    6afad6d46badb8d84671c07f8443e903

    SHA1

    de21f9c3640592faf4a4c09a9dce2af8d8ee22a9

    SHA256

    9e6fc325d5a07e0ca342178b8e1d1e013a8c095cb6b036eb90950ca4c9cc8e06

    SHA512

    526010d1ea432fbee599fe7018ba1c1f49e26449616dbda252523f77e6f00be4f1be8a3e3e2691b7458731d0851f67e3358bacfbe0cdd704729552342f3c1e30

  • /data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journal
    Filesize

    16KB

    MD5

    012dde9bd05f94172fc79132b2ae7e2b

    SHA1

    7f983640f752148adc13b5e127d0f97675ab1340

    SHA256

    46c9eb79f2026e87f80bb95e9fa98c5ad6c1477176e1fa2393cff6277cba9bc5

    SHA512

    601478ea89fa34b36f8dac1ff2ba53bf2e2213a7a8448918e27bc4c17fa9a758c1c1749c1dbc8e5533383c800127707dcd6316496b25baee86780802a36eb4b2

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data
    Filesize

    28KB

    MD5

    1a8dbe6f185573fca9fa253fb66df8bf

    SHA1

    4d537d5cf1f3ff6f556c748b2033e5255737d039

    SHA256

    a79b50f82ffccd49a530a3dd694d8faad11f966b4de5ebea0083ff1e596db041

    SHA512

    022cccf4161b8aae9c4eefb224129c2c1cfa30aa0afadbf74607b5bfc4d5cf2049c812039351fa41eb881c51c0d263cb6445f8306fd1478fed540188b3391d3b

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journal
    Filesize

    8KB

    MD5

    f1bbf3e83a740017e48c76b1347805e6

    SHA1

    74a49c1672cf0915db8c1aa4f5d9396eecfdf568

    SHA256

    9d7a47581f2edfc787976f8c3cd47a811bb62e345db5b20c6b28bb4f47a5b939

    SHA512

    7b0f3e40208a223f3634cc0d5b4390e739c552da34ce8f02845a7c3366a01639f4a1b6bf896ba2e41693983fc1ec8063aee9dd72926a001a9c9fffc5ef178a97

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journal
    Filesize

    16KB

    MD5

    e2e0c0fd763e867f2e9d51dddf8a9d14

    SHA1

    2042915a8d52be5292e801dc37185f0bcb85e979

    SHA256

    e0d1db04915b030505e13e3ce49d3bb2cb8837570b9c6b9ba0d4025b51a28787

    SHA512

    e26266c9dca619cc51d8c8954e55c1a1e3a565bbcc4409c825f533f0baba363ee72ff9eac1873f82b61e7d5ddb37fb6e90935c5e003038b0829d81b0434380d8

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journal
    Filesize

    8KB

    MD5

    0a37a1283de533384108598ffe9fffd6

    SHA1

    30f44cd3a48b3a4e04e3f193156474d8cc0308d7

    SHA256

    00b8f5a7ac63448fa957187d9cc5604b899a846655fb554a4e7c98b47537debc

    SHA512

    2184e61f16197f5bc00223e39fa19d065c6e89728446125049ed33218d18404292bb3af7cccb1300854ff3e173c8a247eacbb1229c2b5a43ffbd4ef3b7efb955

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journal
    Filesize

    8KB

    MD5

    c328134f3ea32ef879b2f77836d30b1b

    SHA1

    8a1c56bd33203e920955c4196ac0db8f429ac26a

    SHA256

    55ae9b5cbca3955f7d08b1e3e9b05f5893d046a6d08b9129c16ade317c8c4df0

    SHA512

    0d1870cfc93c2b3424d7d903429fa2a7e4db8c78faf460ffa673de2fefa61db5e27c6e1bf4c508766b9880be473d073b0780252bc182998bda53ddd59fa03bae

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journal
    Filesize

    512B

    MD5

    12ee6d8a55196ef62635d83ac6762f53

    SHA1

    453cb8ae294368496feb3c2d4ac0d8f89d7a146f

    SHA256

    999dffd25725d43bd7debfc954ad485d553f2cb2377300c4f51ed175d18a84f2

    SHA512

    b66c3e1df2526e70165ba0c7c1dc7113acc4e24a73ea935bad77356ab0514b7a2139b73171e8f849d857f527a3ef1148e6468230db84365ccc8bbb565b0bd204

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journal
    Filesize

    8KB

    MD5

    5b2e1acb41ec090861947e3f109251de

    SHA1

    3e1014c39bda0385fbd1e8cf5c4ea838056ab326

    SHA256

    db72b04f08903520907db188c1dbdffbe81478e07c55261850ed468c34dd35ca

    SHA512

    484d4dd647c9e77400ae95d595289097dbb3466a54ad5655f8c23c55c718483676ce7b1273012523b9bfaf08d855d94bd1432749a3bf4e160371c2884a9cd1e8

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db
    Filesize

    24KB

    MD5

    aeefa734168cb1f1e23e81ee65f1d029

    SHA1

    73a58265629fa44137257fe269502ebace087e94

    SHA256

    c7088a999f5d44475ee07d9d52a287d4a60e7d18f709ec7f34ff81c233f62081

    SHA512

    c89c3ac0083bfda24f62ac73fff99bfe4bdd5df696e467d9251de23b7ad783d33e9f7de29c4c9286b4b7a6a0967e40a969b31f3228ede10ba73452fe4327a038

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journal
    Filesize

    512B

    MD5

    c187cc33f996a508249dd599484e8bf2

    SHA1

    240f8aa5856deffd9ab7b45e1c3cc3d6d039120f

    SHA256

    a116f5f6d4e7ef3dfc2f9ad96c5e1fe816cc6e7a17f16f4f140b9ca920641525

    SHA512

    d0ab3cd930094e3857b8fa2954ad121bab0722564ab0d2056f0ead8d212f8f8b9269471dbe05149e6b4daa39799a5659c200a5a065f18b99a3fcb06fc8ae7499

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journal
    Filesize

    8KB

    MD5

    7f0fa37cd86c0722a84fb4b93d6f7b56

    SHA1

    24912831ad9a266a9a6a06c9a156085a80a49f9e

    SHA256

    3445c5f861c9ef1d1a24d9f08a1850d7362085b3b05a3cde334091d1552b4fc8

    SHA512

    0d193d69d19aec75c36a3e829c5c8f362c3ccb31b1b6bd8be868830caa961f7ce48da8e55d406e77adbc4a0405b743594ddc24d930c74596a81e006024149ee0

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journal
    Filesize

    8KB

    MD5

    e2ada4c1442aea59f00cdfffb0bb76c0

    SHA1

    b02de9a76412b860863162b4a96e4ad134b680c7

    SHA256

    fc7307c312072629d32c385668fcbca5bb16cdabc020eaf3dd8df4fc9654afc7

    SHA512

    d1e860014908b6fff2555af22a2e61b5b3be066baa0ec04a6389482934a92a97650ed5240727310b94efaf110d6a44afb68fb32c1df0b14d013b491bec2cf1d9

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journal
    Filesize

    16KB

    MD5

    564f389ad4180793a5560116693c534d

    SHA1

    b73e336359fd1b48ce5c971d777063d00e102f73

    SHA256

    80b507cb1e283cbf4b2479bd1e95d7225b0e17125ee70cb33382e3adafb379c5

    SHA512

    44fbd2fa6633aab790998857dc120834214de67af947b1c1cabe3b95cf0fe5a70f2c3bed82680bac7dd9be1c03ee8d4801c44a0c6ad8d711bb3998491be10eae

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journal
    Filesize

    16KB

    MD5

    086fb097ed809688ad22c35aa9685162

    SHA1

    defef938343730a6693c2f400b8354e4a9d35432

    SHA256

    29b9478fa6de393bb1082807ba8056182951aa75b5c5405d1b11ac597ee26ca4

    SHA512

    46baa11ace96a109f60f766a9cc315db1951f00b8c7451e480ee73ad95ce3013bede98ea2aec235d06cfa647e82f3c3689f38250cab4ae1b01b6f29068b6f810

  • /data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journal
    Filesize

    16KB

    MD5

    463b6aac4905cbddc79a57fe98d038a9

    SHA1

    6cd1132b16022589e59804ff6eff5934e1bc2b7c

    SHA256

    083b223da5bc7472b5a11a5513fe1191f41661709b15d7485d61c7e20fd73288

    SHA512

    032988404a7b9e648f562811ec035e485259da9fbc7a909ec6fd9d813f7f153b8fb5161537a58616163c3a5aaf0d2b36f0527f50d2bad2e2da2a5e40dca66f2f

  • /data/data/com.mayizaixian.myzx/files/.um/um_cache_1716397159865.env
    Filesize

    591B

    MD5

    036e4515785dd73fad4d3c4183c8b422

    SHA1

    8f7db600d0ba3a442e1ca0ad069a3768c6da4d70

    SHA256

    7076eb285875ec65ebf0fe387d5fce83e99b1e26b6dc8b8ecc86104aedaba3ed

    SHA512

    035b1110c92e59ce7eb75ac2588c53658de960c9c7cb173ebf7d29235ef49478bba18fa2d4ea437b1e322ea8379520c899d0e4b5e2c98d9efce3a148edb8cdd2

  • /data/data/com.mayizaixian.myzx/files/.umeng/exchangeIdentity.json
    Filesize

    162B

    MD5

    6bd2ac61d28a0fdf82b6e53592def221

    SHA1

    0cf9e1912d71f56f39961c5310a4cf47f168befd

    SHA256

    a5b6efd6f20495a273abec27e0ed6ef40e114edf2361b5fbc8bf1c730c7bd3ab

    SHA512

    c8720942603e014f79ca9f31fcb33bdd5c5b801577ebe69a4f6eaec45ee3abf69ed2901f76604926a0f7ba54a32d896d9d6e484cb6d2861777c0a39b2c08cac2

  • /data/data/com.mayizaixian.myzx/files/ixintui_plugin.jar
    Filesize

    54KB

    MD5

    0fd5745abb8efd27d19339cb8bf74c31

    SHA1

    0514c079304f4ca950dca9c5071fc8f149a644f2

    SHA256

    fee09a01b0393e0ee0d4e344b798d990be0783be31b6d8829a6aa9329928a848

    SHA512

    598e6cd7ab9c7147cd532d3c491e3a7158068b7024a8293c9c99cb32e5d1dce0800e3f42b8914380156a0901973c9ced495aee3d9c628f674bc0b23472d2bb96

  • /data/data/com.mayizaixian.myzx/files/oat/ixintui_plugin.jar.cur.prof
    Filesize

    328B

    MD5

    8364b9f6ced4252e25bc2de9dbd2cf7b

    SHA1

    0a102bace59c38b380964acb0f953d4d1837ba9d

    SHA256

    b58bf636acfe37f86e41c345de589a4ac4b80facc3b3d6dca0aec7440662034e

    SHA512

    ea26faba3f39c11c956706fd071bd9a92e2c7f11389a4193a4efd973638d9670b320e39e519282804a92c6f4fd583fa9e20c88d65d5af659cacd1cf09958a9be

  • /data/data/com.mayizaixian.myzx/files/oat/stat_plugin.jar.cur.prof
    Filesize

    115B

    MD5

    43034cc2f3f0ee8a6e19c10421521083

    SHA1

    e969fa65f10d8f1e742d7418f919d52f95554e5a

    SHA256

    e183ad362345bf23c31fc70eab961df2bd82ca9f2cc6bba4f01f9b3a13b3615e

    SHA512

    038aaa33b06e776df8d9c44f2a33af9401fbd1823a5916ac50409325efc72d6e81b97c70148aeaa72a04b184b1551a2aab2fc497f209353347b77a0782dc7531

  • /data/data/com.mayizaixian.myzx/files/stat_plugin.jar
    Filesize

    11KB

    MD5

    6407165af23fa8b3ecf0d65664d316e0

    SHA1

    60a74d827d9b9d80344e9f8669dc520f6d1f5a1b

    SHA256

    66b2e6169631facc018b1ceb4c7b15b406abe2fcc0d04207ad185ea53304b4fa

    SHA512

    c06fc91bc9d9637c634d2e08e90295885c76a765444d0e552d33630c5f591870bc0a8b823d6e26394de131f610a0f72829e42999a4bb38f2894356a410be564e

  • /data/data/com.mayizaixian.myzx/files/umeng_it.cache
    Filesize

    245B

    MD5

    26948c936ea9ebb290c7ba05d270033f

    SHA1

    24e04cf17f70f7226242bfc60fc2952540fed95f

    SHA256

    974deb37a573b3a7a06401b45fc22c23e7f2dc25311076a816bc5c6d85701d3b

    SHA512

    a919811a0e64bb24bb2d135b5b6e6994a96c4bb7e55d8765ac7518770fc0a12b5febed5bfb84eff28050560b2a3ee15c99bbd082c71f3a63ad87753cc1803fb5

  • /data/user/0/com.mayizaixian.myzx/files/ixintui_plugin.jar
    Filesize

    119KB

    MD5

    3bcf8974e4cdf927afb37d9e62e8f5ae

    SHA1

    cb28d4153b06de6f278888be699a44217ace784d

    SHA256

    d47323aae8216609741ff960eae9649086451d4399c67fb813b6a2f6abb2f841

    SHA512

    83cbaaef1cee4d83d184e4766708239829d3c512864fecc9e9d75e7318d6bde45bdcde472d116c9effdb70d13967709fd4d7eaaf9b4a58dfc0ec923437498e04

  • /data/user/0/com.mayizaixian.myzx/files/stat_plugin.jar
    Filesize

    22KB

    MD5

    fbfd3d5c8dfdfb06f712bbc4db2645eb

    SHA1

    0bcaac6931feb1262c618c12040dd43ad13d0b61

    SHA256

    be9ad9cfad08657b6ebb1a4ed6ab1dc24d817cac644605bad6fa85b3ecbc8059

    SHA512

    07401ec8e2024ffce0d8264e9ba6abd061c3c16f33acbb3836b9523e0969ff1fc48f8d84621fa7d2f50390d2cab730d2a3467e8e90f2f60dc929e63ee2af8537

  • /storage/emulated/0/ShareSDK/.ba
    Filesize

    377B

    MD5

    6a3745be7f7fa0cdfad2037824e34300

    SHA1

    4e7f86dc0032e328311fb026d0b4de87ea2e1a6c

    SHA256

    2d8cfdcbbbffaff0848df059a890576963daaa0e0fc8111305b8d1f041a1c455

    SHA512

    cb8ff2f731f844e1dba81ab9c862fa42cfc3173d1970e3682e32340c579251bd924ec5a9ec62226c61b36a5ddce06ae7735988548ace750d310135f502494243

  • /storage/emulated/0/ShareSDK/.ba
    Filesize

    476B

    MD5

    9f2ab444546f6dc7b0157046029cf95b

    SHA1

    3e0c4eb9f42f66636b9ed43a2d7de3e06e408ab1

    SHA256

    d7dd9c1ebf7852d5a2f07edb56939d155635aaf51701a52b6b513ddb947967cd

    SHA512

    2790b4970042b38f6477d5606423ab9c6120a721da4449ac2837724334d2ddeb7fe43e4e15b03f43ae2f96bf56accff8d2a67751f28e8f7a54468ecc66b7712b

  • /storage/emulated/0/ShareSDK/.dk
    Filesize

    107B

    MD5

    9571b8148c1d4d267bd088138efaa1b6

    SHA1

    06446151883ecc2a6c829990d8c7e050796aa978

    SHA256

    a9d51edcf4925ecc9101191acdd74f1f1b8f7132be569188d38431a82c90c852

    SHA512

    f8bbc044871265a978c098f47960eb6184d87e03017935fb536510f18233028d7fd5d8c1b0d96f055dcd527a133e2f4c8c07b8ba6defe348047bb7b6b40934d8